Fix buffer overflow in parseTimeLineHistory when timeline > 1024

[dimitri]

Problem

When a pg_auto_failover cluster has undergone more than ~1024 failovers, its current PostgreSQL timeline number exceeds 1024. At that point the TIMELINE_HISTORY replication command returns more than 1024 lines, overflowing the fixed-size history[PG_AUTOCTL_MAX_TIMELINES] array inside TimeLineHistory.

parseTimeLineHistory writes a "tip" entry unconditionally after the loop at history[count], where count has just reached 1024 — one slot past the end of the array. Each additional timeline pushes that write further into memory. The array is the last field of IdentifySystem, which is the last field of ReplicationSource, which is embedded in LocalPostgresServer. The overflow therefore corrupts the fields that immediately follow in that struct: pgIsRunning, pgsrSyncState, currentLSN, pgFirstStartFailureTs, pgStartRetries, and pgKind.

The keeper then logs:

nodeKindToString: unknown node kind XX

and behaves incorrectly because pgKind now holds garbage bytes from the overwritten LSN data.

This bug is in the keeper (client code, src/bin/common/pgsql.c). The monitor is not involved.

Fix

Replace the fixed-size array in TimeLineHistory with a heap-allocated pointer:

typedef struct TimeLineHistory
{
    int count;
    int capacity;
    TimeLineHistoryEntry *history;   /* NULL until first parseTimeLineHistory() call */
} TimeLineHistory;

parseTimeLineHistory() allocates the buffer on first use and grows it with realloc() (doubling strategy) when needed. Because ReplicationSource is embedded in the long-lived Keeper struct, the buffer is reused across repeated pgctl_identify_system() calls and freed by the OS on process exit — no explicit cleanup path is needed.

All consumer sites (cli_do_misc.c, pgsql.c:3041) already use history[index] pointer-subscript syntax, which is syntactically identical whether history is a fixed array or a heap pointer — no changes to those callers are required.

Closes: #1107